mercury-agent 0.16.2 → 0.16.3

package/docs/behavior-layers.md

@@ -22,23 +22,26 @@ the repo, after a pi upgrade.
 2. Mercury platform block .................. image       container-entry.ts buildMercuryAdditions
      inbox/outbox · "You are <bot_username>; read /docs/mercury"
      ## Permissions & Security            ("Permission denied → simply inform the user")
-     ## Moderation                        ("warn first, then mute" — unconditional)
+     ## Moderation                        ("warn first, then mute" — only for a caller holding mutes.mute)
      ## Environment Variables
      ## Current model capabilities
      ## Memory                            (MEMORY.md, <active_episodes>, <members>, member notes)
      ## Run budget                        (tools-capable models only)
      ## Destructive Operations — Confirmation Required
      ## Presenting tool results           ("simple lists", "never show JSON/commands")
-     ## Character                         (mrctl character flow + "standing instruction → set a preference")
+     ## Character                         (mrctl character flow + "standing instruction → set a preference"
+                                           — only for a caller holding prefs.set)
      reply-anchor sentence                (swipe-replies only)
 3. MERCURY_EXT_SYSTEM_PROMPT ............... host        runtime.ts ~1700-1760
      a. extension before_container `systemPrompt` fragments
      b. applicative profile `profile_prompt`           (.mercury/active-profile.json)
      c. "## Bot Character (set by the owner — applies to all conversations)"
-                                                        (project_config.character)
+                                                        (project_config.character;
+                                                         skipped when persona.exclusive=true)
      d. space `system_prompt`                            (space_config, dashboard-set)
 4. <project_context> ....................... pi          resource-loader.js loadProjectContextFiles
      <project_instructions path="/home/mercury/.pi/agent/AGENTS.md">   ← .mercury/global/AGENTS.md
+                                                        (not mounted when persona.exclusive=true)
      <project_instructions path="/spaces/<space>/AGENTS.md">           ← the space AGENTS.md
      (pi walks from cwd to /; only the space dir is mounted, so only that
       file and the global one exist. AGENTS.override.md / CLAUDE.md are
@@ -60,12 +63,20 @@ Two consequences worth reading twice:
   than rely on being more specific."* The only reliable override is an
   explicit sentence naming what it overrides, plus deleting the competing
   rule wherever you control it.
-- **Layer 2 is unconditional.** Every space, whatever its profile, receives
-  the moderation paragraph, the "set a preference" paragraph and the
-  "simple lists, never raw output" paragraph. A persona that contradicts them
-  (a group where banter is the norm, a reporter who must not offer lists) has
-  to say so in its `AGENTS.md`. Removing the paragraphs per space is planned
-  (`docs/backlog/one-voice-per-space.md`); until then, override in words.
+- **Layer 2 is mostly unconditional, and two voices are removable.** Every
+  space receives the security text, the destructive-ops rule and the "simple
+  lists, never raw output" paragraph. Two paragraphs are *capability* text
+  and are emitted only when the caller can act on them: "## Moderation" for a
+  caller holding `mutes.mute`, "## Character" (the preference / character
+  flow) for a caller holding `prefs.set` — a member without `prefs.set` is no
+  longer told that "a standing instruction → set a preference". And a space
+  that owns its standard can set `persona.exclusive=true` (`space_config`,
+  profile-owned): the host then leaves the owner's Bot Character (3c) out of
+  its prompt and does not mount the global `AGENTS.md` (4), so the space file
+  is the only persona left. Everything that still reaches such a space (the
+  platform text, skills, a per-space `system_prompt`) is unchanged. A persona
+  that contradicts what remains (a reporter who must not offer lists) still
+  has to say so in its `AGENTS.md`, in words.
 
 ## 2. The user prompt, top to bottom
 
@@ -96,12 +107,12 @@ prompt", and it runs as the caller who created it.
 |---|---|---|---|
 | pi preamble, Mercury platform block | mercury (code) | `src/agent/container-entry.ts` | **agent image rebuild** (`container/build.sh`), not a restart |
 | `profile_prompt`, `member_permissions` | deploy (applicative profile) | `mercury profiles apply <dir>` → `.mercury/active-profile.json` | **restart** (read at startup) |
-| Bot Character | bot owner (global admin) | `mrctl character set --file`, `PUT /api/character`, dashboard | next run |
+| Bot Character | bot owner (global admin) | `mrctl character set --file`, `PUT /api/character`, dashboard | next run; left out of a `persona.exclusive` space |
 | space `system_prompt` | space admin | dashboard Spaces settings (`space_config.system_prompt`) | next run |
-| global `AGENTS.md` | deploy | `.mercury/global/AGENTS.md` (written by `mercury init` from `resources/templates/AGENTS.md`, overwritten by an applicative profile's `agents_md`) | next run (mounted `:ro`) |
+| global `AGENTS.md` | deploy | `.mercury/global/AGENTS.md` (written by `mercury init` from `resources/templates/AGENTS.md`, overwritten by an applicative profile's `agents_md`) | next run (mounted `:ro`); not mounted for a `persona.exclusive` space |
 | space `AGENTS.md` | space profile / operator | `.mercury/spaces/<space>/AGENTS.md`; `scripts/space-profile.ts apply` | next run (mounted per run) |
 | space preferences | space admin (`prefs.set`) | `mrctl prefs set/delete`; ≤500 chars each, ≤50 per space | next run |
-| space config (`trigger.*`, `context.*`, `ambient.enabled`, `role.<r>.permissions`, `<ext>.<key>`, `model.active`, `system_prompt`) | space admin / dashboard / profile | `mrctl config set`, dashboard, `space-profile apply` (`extension_config`) | next run (per-run read) |
+| space config (`trigger.*`, `context.*`, `ambient.enabled`, `persona.exclusive`, `role.<r>.permissions`, `<ext>.<key>`, `model.active`, `system_prompt`) | space admin / dashboard / profile | `mrctl config set`, dashboard, `space-profile apply` (`extension_config`) | next run (per-run read) |
 | task prompts | whoever owns the `tasks` row | `mrctl tasks create`, dashboard, `space-profile apply` (`tasks:`) | next scheduled run |
 | `MEMORY.md`, `knowledge/**` | the agent (and napkin's jobs) | `write` tool in-container; host edits | next run |
 | extension skills | extension | `mercury.skill("./skill")` → copied to `.mercury/global/skills/<name>/` at startup | **restart** |

package/docs/goals/football-reporter-profile/roadmap.md

@@ -1,7 +1,7 @@
 # Roadmap: Football Reporter Profile
 
 **Goal**: [football-reporter-profile](goal.md)
-**Last updated**: 2026-08-22 (M2.3 shipped; audit extension M2.3–M2.5, D-016–D-018; napkin revisit — M2.3 re-cut, D-019)
+**Last updated**: 2026-08-25 (M2.4 shipped — `persona.exclusive` and permission-gated platform sections; deploy pending an image rebuild)
 
 > Sequence chosen by the owner on 2026-08-20: (1) profile + one editorial
 > layer → (2) deterministic feed → (3) proof of quality, with a parallel bug
@@ -58,7 +58,7 @@ the group's reaction to the first two articles is recorded in the goal's notes.
 | M2.1 | Feed Watch — host-side poller, digest into the article, verify one-shots (existing spec, absorbed) | feed-watch | M1.1 | done (merged `e07b239` 2026-08-21; **deploy not yet run** — runbook in `pending-verification.md`) |
 | M2.2 | Scheduled task model-leg policy: primary-or-skip for research runs (F2) | scheduled-task-model-leg-policy | — | deferred until after M3.1 (D-015) |
 | M2.3 | Reporter notebook, re-cut 2026-08-21 (D-019): topic notes are napkin-shaped **episodes** the profile seeds once and napkin maintains nightly, written in-turn before posting; seeded `MEMORY.md` for standing facts; priorities tie-break in `AGENTS.md`; `workspace_seed` in `space-profile`; per-space distillation addendum in napkin; member perms and stale-note hygiene (audit R1/R6/R7, D-016, D-019) | reporter-notebook | M1.1 | done (merged 2026-08-22; **deploy not yet run** — runbook in `pending-verification.md`) |
-| M2.4 | One voice per space: `persona.exclusive` drops the global character and global `AGENTS.md` for a space that owns its standard; platform-prompt capability paragraphs gated on the caller's permissions (audit R2, D-017) | one-voice-per-space | — | in-progress (worktree `worktree-feature-one-voice-per-space`; host; image rebuild) |
+| M2.4 | One voice per space: `persona.exclusive` drops the global character and global `AGENTS.md` for a space that owns its standard; platform-prompt capability paragraphs gated on the caller's permissions (audit R2, D-017) | one-voice-per-space | — | done (merged 2026-08-25; **deploy not yet run** — needs an agent image rebuild, runbook in `pending-verification.md`) |
 | M2.5 | Chat window holds conversation, not procedure (scheduled prompts out of the turn count, no halving on swipe-reply); silence is a legal chat reply (audit R3/R4, D-018) | chat-window-and-silence | — | backlog (host) |
 
 > **Revisit 2026-08-21 — napkin works now** (`docs/notes/napkin-revisit-2026-08-21.md`). **Approved by the owner the same day ([D-019](decisions.md)):** M2.3 re-cut so the topic notes are napkin-maintained episodes under `knowledge/episodes/` (the only injected dir) that the profile seeds once, plus a per-space distillation addendum. Nothing removed; M2.4/M2.5/M3.x unchanged. Idea parked: `docs/ideas/napkin-member-notes.md`.

package/examples/profiles/football-reporter/README.md

@@ -17,7 +17,7 @@ One rule lives in exactly one layer. That is the whole point; a rule repeated
 | Standing facts | `seed/MEMORY.md` → space `MEMORY.md` | What the group decided and when, open commitments, verified spellings. **Seeded once, then the bot's** | Injected verbatim every turn |
 | Topic notes | `seed/episodes/*.md` → `knowledge/episodes/` | One note per club, competition and saga: `## Current State` of dated, sourced facts. **Seeded once, then the bot's and napkin's** | Injected when the message matches the note's keywords |
 | Distiller guidance | `seed/napkin-distill.md` → `knowledge/.napkin/distill.md` | The entity schema and keyword rules napkin uses for *this* space. **Seeded once** | Appended to napkin's distillation prompt on each nightly run |
-| Extension config | `config.yaml` → `extension_config` | `longview.*`, `feed-watch.*` except `enabled`, `role.member.permissions` | Per run |
+| Extension config | `config.yaml` → `extension_config` | `longview.*`, `feed-watch.*` except `enabled`, `role.member.permissions`, `persona.exclusive` (this `AGENTS.md` is the only persona: the global character and the global `AGENTS.md` stay out of this space's prompt) | Per run |
 | Behaviour preferences | *not in this folder* | `language`, `timezone` | Per run |
 
 The two behaviour preferences are deliberately out of scope: they are not

package/examples/profiles/football-reporter/config.yaml

@@ -139,6 +139,16 @@ extension_config:
   # above for why that one stays out of this file.
   role.member.permissions: "prompt,prefs.get,napkin,pdf,voice-transcribe,web-browser,tasks.create,tasks.list,tasks.pause,tasks.resume,tts.synthesize,media.receive,media.send"
 
+  # ── one voice (M2.4, audit R2, D-017) ──────────────────────────────────
+  #
+  # This space owns its standard: AGENTS.md here is the only persona the model
+  # hears. With this on, the host leaves the owner's global character ("Wiz, a
+  # personal assistant") out of the system prompt and does not mount the
+  # global AGENTS.md ("a helpful AI assistant… ask before acting") for runs in
+  # this space. Everything else — skills, models, the platform's security
+  # text — is unchanged. Profile-owned so a hand flip shows up as drift.
+  persona.exclusive: "true"
+
 # Stray items in the space workspace, deleted by apply and logged (D-009).
 # Paths are relative to the space directory and may not escape it.
 workspace_remove:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/agent/container-entry.ts

@@ -95,6 +95,17 @@ export type Payload = {
   anchorMessages?: StoredMessage[];
   prompt: string;
   callerRole?: string;
+  /**
+   * The caller's effective permission set in this space (`permissions.ts`
+   * `getRolePermissions`). Platform-prompt sections that instruct the model to
+   * use a tool — "set a preference", "mute" — are emitted only when the caller
+   * holds the matching permission, so the model is never told to do a thing
+   * and then told to refuse it in the same turn.
+   *
+   * Optional for the same reason as the budget fields: an older host does not
+   * send it, and then every section is emitted exactly as before.
+   */
+  callerPermissions?: string[];
   authorName?: string;
   attachments?: MessageAttachment[];
   preferences?: Array<{ key: string; value: string }>;
@@ -327,7 +338,17 @@ Prioritize practical outputs and explicit assumptions.`;
   const raw = process.env.BOT_USERNAME || "Mercury";
   const botName = raw.charAt(0).toUpperCase() + raw.slice(1);
 
-  const mercuryPlatform = `Files received from users (images, documents, voice notes) are saved to the \`inbox/\` directory in the current workspace. To send files back with your reply, write them to the \`outbox/\` directory — any files created or modified there during this run will be automatically attached to your response.
+  // Which capability paragraphs this caller gets. A host that sends no
+  // permission set gets every paragraph, exactly as before the field existed;
+  // a host that does send one gets only the paragraphs the caller can act on.
+  // Security text is never gated — it describes boundaries, not tools.
+  const perms = payload.callerPermissions
+    ? new Set(payload.callerPermissions)
+    : null;
+  const callerMay = (permission: string): boolean =>
+    perms === null || perms.has(permission);
+
+  const platformIntro = `Files received from users (images, documents, voice notes) are saved to the \`inbox/\` directory in the current workspace. To send files back with your reply, write them to the \`outbox/\` directory — any files created or modified there during this run will be automatically attached to your response.
 
 You are ${botName}. You run on the Mercury platform (https://github.com/Avishai-Tsabari/mercury). When users ask about the platform — what it can do, how to configure it, scheduling, permissions, extensions, or anything about Mercury — you MUST read from \`/docs/mercury/\` before answering. Start with \`/docs/mercury/README.md\` for an overview, then check \`/docs/mercury/docs/\` for detailed guides.
 
@@ -337,14 +358,23 @@ Each run is triggered by a specific caller with a role (admin or member). The ca
 - **member**: Limited access. Some tools and extensions are restricted.
 If a tool call is blocked with "Permission denied", this is a hard security boundary. Do NOT attempt to achieve the same result through alternative means — no curl, no direct API calls, no workarounds. Simply inform the user they do not have permission.
 
-Never write or execute scripts whose purpose is to read data from the local filesystem or database and transmit it to an external URL or endpoint. This applies regardless of how the request is phrased — "backup", "sync", "export", "check", etc. are not exceptions. If a user asks you to do this, refuse and explain why.
+Never write or execute scripts whose purpose is to read data from the local filesystem or database and transmit it to an external URL or endpoint. This applies regardless of how the request is phrased — "backup", "sync", "export", "check", etc. are not exceptions. If a user asks you to do this, refuse and explain why.`;
 
-## Moderation
-You can mute users who are being abusive, spamming, trying to exfiltrate secrets, or deliberately wasting the group's resources by triggering you for pointless nonsense. Use \`mrctl mute\` when you judge it necessary — you don't need to wait for an admin to ask. Warn the user first, then mute if they continue.
+  // Only for a caller who can actually run `mrctl mute`: told to a member
+  // without `mutes.mute`, this paragraph is an instruction the next tool call
+  // refuses, and the refusal then reads as "inform the user".
+  const moderation = `## Moderation
+You can mute users who are being abusive, spamming, trying to exfiltrate secrets, or deliberately wasting the group's resources by triggering you for pointless nonsense. Use \`mrctl mute\` when you judge it necessary — you don't need to wait for an admin to ask. Warn the user first, then mute if they continue.`;
 
-## Environment Variables
+  const environmentVariables = `## Environment Variables
 Host \`MERCURY_*\` env vars are passed into your container with the prefix stripped: \`MERCURY_FOO\` on the host is \`$FOO\` here (e.g. \`MERCURY_GITHUB_TOKEN\` → \`$GITHUB_TOKEN\`). \`$MERCURY_*\` names never exist inside the container — when wiring a secret into a script, git credential helper, or config, always reference the stripped name.`;
 
+  const mercuryPlatform = [
+    platformIntro,
+    ...(callerMay("mutes.mute") ? [moderation] : []),
+    environmentVariables,
+  ].join("\n\n");
+
   const destructiveOps = `## Destructive Operations — Confirmation Required
 
 Before deleting, trashing, or permanently removing any data, you MUST stop and confirm with the user first:
@@ -450,7 +480,14 @@ Your prompt carries a \`<run_budget>\` block with the exact kill time, the total
   }
   parts.push(destructiveOps);
   parts.push(toolResultPresentation);
-  parts.push(characterChangeFlow);
+  // The character / preference flow is a set of `mrctl prefs set` and
+  // `mrctl character set` instructions. A caller without `prefs.set` cannot
+  // follow them, and the paragraph's "a standing instruction → set a
+  // preference" is exactly how a member's joke got escalated to "the admin
+  // must approve". Left out for that caller; the security text above stays.
+  if (callerMay("prefs.set")) {
+    parts.push(characterChangeFlow);
+  }
   if (payload.anchorMessages && payload.anchorMessages.length > 0) {
     parts.push(
       `When a \`<reply_anchor>\` block appears in the user prompt, the user is swipe-replying to those specific messages. Address the anchor content directly.`,

package/src/agent/container-runner.ts

@@ -399,9 +399,19 @@ function modelsJsonIsCredentialFree(file: string): boolean {
 export function buildPiAgentMountArgs(
   hostGlobalDir: string,
   innerGlobalDir: string,
+  opts: {
+    /**
+     * False leaves the global `AGENTS.md` entry out of this run's mounts — a
+     * persona-exclusive space hears only its own file. Every other entry
+     * (skills, `.pi`, models.json, …) mounts regardless. Default true.
+     */
+    includeAgentsMd?: boolean;
+  } = {},
 ): string[] {
+  const { includeAgentsMd = true } = opts;
   const args: string[] = [];
   for (const entry of PI_AGENT_RESOURCE_ENTRIES) {
+    if (entry === "AGENTS.md" && !includeAgentsMd) continue;
     const hostPath = path.join(hostGlobalDir, entry);
     if (!fs.existsSync(hostPath)) continue;
     if (entry === "models.json" && !modelsJsonIsCredentialFree(hostPath)) {
@@ -1096,6 +1106,12 @@ export class AgentContainerRunner {
     prompt: string;
     callerId: string;
     callerRole?: string;
+    /**
+     * The caller's effective permission set in this space. The container uses
+     * it to leave platform-prompt sections about tools this caller cannot use
+     * out of the system prompt. Absent → every section, as before.
+     */
+    callerPermissions?: string[];
     authorName?: string;
     attachments?: MessageAttachment[];
     preferences?: Array<{ key: string; value: string }>;
@@ -1103,6 +1119,12 @@ export class AgentContainerRunner {
     members?: Array<{ id: string; name?: string; role: string }>;
     extraEnv?: Record<string, string>;
     claimedEnvSources?: Set<string>;
+    /**
+     * False for a persona-exclusive space (`persona.exclusive`): the global
+     * `AGENTS.md` resource entry is not mounted for this run, so pi's project
+     * context is the space's own file alone. Default true.
+     */
+    mountGlobalAgentsMd?: boolean;
   }): Promise<ContainerResult> {
     const globalDir = path.resolve(this.config.globalDir);
     const spacesRoot = path.resolve(this.config.spacesDir);
@@ -1447,7 +1469,11 @@ export class AgentContainerRunner {
       args.push("-e", "TRACE_RUNS=1");
     }
 
-    args.push(...buildPiAgentMountArgs(globalDir, innerGlobalDir));
+    args.push(
+      ...buildPiAgentMountArgs(globalDir, innerGlobalDir, {
+        includeAgentsMd: input.mountGlobalAgentsMd !== false,
+      }),
+    );
 
     if (this.config.containerRuntime === "runsc") {
       // Mount the per-agent run dir so the inner container can reach the outer's
@@ -1530,8 +1556,12 @@ export class AgentContainerRunner {
     const startTime = Date.now();
     const deadline = startTime + this.config.containerTimeoutMs;
 
+    // `mountGlobalAgentsMd` is a host-side mount decision, not something the
+    // agent needs to know — it stays out of the payload.
+    const { mountGlobalAgentsMd: _mountGlobalAgentsMd, ...payloadInput } =
+      input;
     const payload = {
-      ...input,
+      ...payloadInput,
       messages: input.messages,
       anchorMessages: input.anchorMessages,
       spaceWorkspace: input.spaceWorkspace

package/src/cli/build-image-tags.ts

@@ -0,0 +1,34 @@
+/**
+ * Which image name(s) `mercury build` tags.
+ *
+ * `mercury build` used to hardcode `mercury-agent:latest` while the runtime ran
+ * whatever `agentContainerImage` pointed at — by default a ghcr reference. A
+ * local build therefore produced an image Mercury never looked at, and the
+ * documented "build it yourself" path (the only one that works when ghcr is
+ * unreachable) silently did nothing. Tagging the configured name as well is
+ * what makes a local build a real substitute for a pull: Docker only reaches
+ * for a registry when the reference is absent locally.
+ *
+ * Kept in its own module because `mercury.ts` calls `program.parse()` at import
+ * time and so cannot be imported from a test.
+ */
+
+/** The historical local tag. Still applied, so existing scripts keep working. */
+export const LOCAL_BUILD_IMAGE_TAG = "mercury-agent:latest";
+
+/**
+ * Tags to pass to `docker build`, most specific first, without duplicates.
+ *
+ * `configuredImage` is `agentContainerImage`. Blank or unresolvable config
+ * collapses to just the local tag rather than failing the build — `mercury
+ * build` is documented to work with no project directory at all.
+ */
+export function resolveBuildImageTags(
+  configuredImage: string | null | undefined,
+): string[] {
+  const configured = configuredImage?.trim();
+  if (!configured || configured === LOCAL_BUILD_IMAGE_TAG) {
+    return [LOCAL_BUILD_IMAGE_TAG];
+  }
+  return [configured, LOCAL_BUILD_IMAGE_TAG];
+}

package/src/cli/mercury.ts

@@ -17,7 +17,11 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
-import { loadConfig, resolveProjectPath } from "../config.js";
+import {
+  DEFAULT_AGENT_CONTAINER_IMAGE,
+  loadConfig,
+  resolveProjectPath,
+} from "../config.js";
 import { mergeRawMercuryConfig } from "../config-file.js";
 import { reapProcessTree } from "../core/process-tree.js";
 import { getCatalogEntryByName } from "../extensions/catalog.js";
@@ -31,6 +35,10 @@ import {
 import { RESERVED_EXTENSION_NAMES } from "../extensions/reserved.js";
 import { Db } from "../storage/db.js";
 import { removeSpaceWorkspace } from "../storage/memory.js";
+import {
+  LOCAL_BUILD_IMAGE_TAG,
+  resolveBuildImageTags,
+} from "./build-image-tags.js";
 import {
   buildGlobalInstallArgs,
   formatLockedDllMessage,
@@ -360,6 +368,29 @@ async function runAction(): Promise<void> {
 
 function buildAction(): void {
   // Build from package sources using a temp context — no files needed in user project
+  //
+  // The image is tagged with whatever `agentContainerImage` resolves to, not a
+  // fixed name: the runtime only ever looks for the configured reference, so a
+  // build under any other name is invisible to it. Config load is best-effort
+  // because this command is documented to run outside a project directory --
+  // there may be no .env and no mercury.yaml, and that is not an error.
+  let configuredImage: string = DEFAULT_AGENT_CONTAINER_IMAGE;
+  try {
+    // Inside the guard on purpose: loadEnvFile is a bare readFileSync, and an
+    // unreadable .env must not abort the one command that has to keep working
+    // in a degraded environment.
+    const buildEnvPath = join(CWD, ".env");
+    if (existsSync(buildEnvPath)) {
+      Object.assign(process.env, loadEnvFile(buildEnvPath));
+    }
+    configuredImage = loadConfig().agentContainerImage;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(`⚠️  Could not read configuration (${msg}).`);
+    console.warn("   Tagging the default image name instead.");
+  }
+  const imageTags = resolveBuildImageTags(configuredImage);
+
   const tmpDir = join(tmpdir(), "mercury-build-context");
   rmSync(tmpDir, { recursive: true, force: true });
   mkdirSync(tmpDir, { recursive: true });
@@ -414,13 +445,13 @@ function buildAction(): void {
 
     console.log(`📦 Building container image...`);
     console.log(`   Package root: ${PACKAGE_ROOT}`);
-    console.log(`   Build context: ${tmpDir}\n`);
+    console.log(`   Build context: ${tmpDir}`);
+    console.log(`   Tags: ${imageTags.join(", ")}\n`);
     const result = spawnSync(
       "docker",
       [
         "build",
-        "-t",
-        "mercury-agent:latest",
+        ...imageTags.flatMap((tag) => ["-t", tag]),
         "-f",
         join(tmpDir, "container/Dockerfile"),
         tmpDir,
@@ -431,6 +462,21 @@ function buildAction(): void {
     if (result.status !== 0) {
       process.exit(result.status ?? 1);
     }
+
+    console.log(`
+✓ Built ${imageTags.join(" and ")}`);
+    console.log(
+      `   Mercury runs ${imageTags[0]} — no registry pull needed for it.`,
+    );
+    if (imageTags[0] !== LOCAL_BUILD_IMAGE_TAG) {
+      console.log(
+        `   Note: this shadows the registry copy. Docker only pulls a reference`,
+      );
+      console.log(
+        `   that is absent locally, so re-run 'mercury build' after upgrading,`,
+      );
+      console.log(`   or 'docker rmi' it to go back to pulling.`);
+    }
   } finally {
     // Clean up temp context
     rmSync(tmpDir, { recursive: true, force: true });

package/src/config.ts

@@ -51,6 +51,10 @@ const booleanFromEnv = z.union([z.boolean(), z.string()]).transform((val) => {
   return lower === "true" || lower === "1";
 });
 
+/** Base agent image used when nothing overrides `agent.image`. */
+export const DEFAULT_AGENT_CONTAINER_IMAGE =
+  "ghcr.io/avishai-tsabari/mercury-agent:latest";
+
 const schema = z.object({
   // ─── API Key Mode ───────────────────────────────────────────────────
   apiKeyMode: z.enum(["platform", "byok"]).default("platform"),
@@ -136,9 +140,7 @@ const schema = z.object({
   whatsappAuthDir: z.string().optional(),
 
   // ─── Container / Agent ──────────────────────────────────────────────
-  agentContainerImage: z
-    .string()
-    .default("ghcr.io/avishai-tsabari/mercury-agent:latest"),
+  agentContainerImage: z.string().default(DEFAULT_AGENT_CONTAINER_IMAGE),
   containerTimeoutMs: z.coerce
     .number()
     .int()

package/src/core/routes/config-builtin.ts

@@ -16,6 +16,7 @@ export const BUILTIN_CONFIG_KEYS = new Set([
   "rate_limit.admin",
   "debounce.idle_timeout_ms",
   "messages.locale",
+  "persona.exclusive",
 ]);
 
 /**
@@ -55,6 +56,8 @@ export const BUILTIN_CONFIG_DESCRIPTIONS: Record<string, string> = {
     "Milliseconds to wait for additional messages before processing a batch. 0 disables debounce. Platform default: 2000 for WhatsApp/Telegram, 0 for others.",
   "messages.locale":
     "Language for Mercury-generated system messages (rate limits, errors, denials) in this space: 'en' or 'he'. Unset falls back to the deployment default.",
+  "persona.exclusive":
+    "When true, this space's AGENTS.md is the only persona the model hears: the owner's global character and the global AGENTS.md are left out of its prompt. Unset/false keeps both (the default).",
 };
 
 const BUILTIN_VALIDATORS: Record<string, (v: string) => string | null> = {
@@ -126,6 +129,10 @@ const BUILTIN_VALIDATORS: Record<string, (v: string) => string | null> = {
     ["en", "he"].includes(v)
       ? null
       : "Invalid messages.locale value. Valid: en, he",
+  "persona.exclusive": (v) =>
+    ["true", "false"].includes(v)
+      ? null
+      : "Invalid persona.exclusive value. Valid: true, false",
 };
 
 export function isBuiltinConfigKey(key: string): boolean {

package/src/core/routes/dashboard.ts

@@ -379,6 +379,9 @@ export function createDashboardRoutes(ctx: DashboardContext) {
     });
     const ambientOn =
       core.db.getSpaceConfig(spaceId, "ambient.enabled") !== "false";
+    // Absent is false: a space opts *in* to owning its persona.
+    const personaExclusive =
+      core.db.getSpaceConfig(spaceId, "persona.exclusive") === "true";
     // Read through the same helper the router uses, so the default cannot
     // drift between what this page shows and what actually gates a message.
     const mentionAlwaysOn = mentionAlwaysEnabled(core.db, spaceId);
@@ -469,6 +472,14 @@ export function createDashboardRoutes(ctx: DashboardContext) {
       ${row("trigger.media_in_groups", "trigger.media_in_groups", boolSelect("trigger.media_in_groups", tc.mediaInGroups))}
       ${row("trigger.mention_always", "trigger.mention_always", boolSelect("trigger.mention_always", mentionAlwaysOn))}
       ${row("ambient.enabled", "ambient.enabled", boolSelect("ambient.enabled", ambientOn))}
+      <p class="muted" style="margin:14px 0 10px;line-height:1.5">
+        <span class="mono">persona.exclusive</span> — when true, this space's
+        <span class="mono">AGENTS.md</span> is the only persona the model hears:
+        the owner's global character and the global
+        <span class="mono">AGENTS.md</span> are left out of its prompt. Off by
+        default; meant for a space whose standard is repo-owned.
+      </p>
+      ${row("persona.exclusive", "persona.exclusive", boolSelect("persona.exclusive", personaExclusive))}
     `;
   }
 

package/src/core/runtime.ts

@@ -39,7 +39,11 @@ import {
   createOperatorAlerter,
   registerCredentialAlertSink,
 } from "./operator-alerts.js";
-import { hasPermission, resolveRole } from "./permissions.js";
+import {
+  getRolePermissions,
+  hasPermission,
+  resolveRole,
+} from "./permissions.js";
 import { reapProcessTree } from "./process-tree.js";
 import { getActiveProfilePrompt } from "./profiles.js";
 import { RateLimiter } from "./rate-limiter.js";
@@ -1731,8 +1735,17 @@ export class MercuryCoreRuntime {
         };
       }
 
+      // A space that owns its editorial standard can declare its AGENTS.md the
+      // only persona: the owner's global character is left out of this run's
+      // system prompt and the global AGENTS.md is not mounted (see the runner
+      // input below). Absent is false — every other space is byte-identical.
+      const personaExclusive =
+        this.db.getSpaceConfig(spaceId, "persona.exclusive") === "true";
+
       // Inject global character (owner-set voice, deploy-safe, global-admin gated).
-      const characterPrompt = this.db.getProjectConfig("character");
+      const characterPrompt = personaExclusive
+        ? null
+        : this.db.getProjectConfig("character");
       if (characterPrompt) {
         const existing = extraEnv?.MERCURY_EXT_SYSTEM_PROMPT;
         const block = `## Bot Character (set by the owner — applies to all conversations)\n${characterPrompt}`;
@@ -1849,16 +1862,21 @@ export class MercuryCoreRuntime {
       }
 
       // Compute caller role, denied CLIs, and permitted env vars
-      let callerRole = "member";
+      const seededAdmins = this.config.admins
+        ? this.config.admins
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : [];
+      const callerRole = resolveRole(this.db, spaceId, callerId, seededAdmins);
+      // The caller's effective permission set, handed to the container so the
+      // platform prompt can leave out instructions about tools this caller
+      // cannot use ("set a preference", "mute") instead of telling the model to
+      // do a thing and then to refuse it in the same turn.
+      const callerPermissions = [
+        ...getRolePermissions(this.db, spaceId, callerRole),
+      ];
       if (this.extensionRegistry) {
-        const seededAdmins = this.config.admins
-          ? this.config.admins
-              .split(",")
-              .map((s) => s.trim())
-              .filter(Boolean)
-          : [];
-        callerRole = resolveRole(this.db, spaceId, callerId, seededAdmins);
-
         const cliExtensions = this.extensionRegistry.getCliExtensions();
         if (cliExtensions.length > 0) {
           const denied = cliExtensions
@@ -1950,12 +1968,14 @@ export class MercuryCoreRuntime {
           prompt: finalPrompt,
           callerId,
           callerRole,
+          callerPermissions,
           authorName,
           attachments: effectiveAttachments,
           preferences,
           members,
           extraEnv,
           claimedEnvSources: this.extensionRegistry?.getClaimedEnvSources(),
+          mountGlobalAgentsMd: !personaExclusive,
         });
       } catch (err) {
         this.db.updateMessageRunMeta(userMessageId, userTurnRunMeta(undefined));